Check that mark_chain_precision() is called for a NULL pointer passed as an __arg_trusted __arg_nullable argument of a global subprogram.
Unified · Split
| @@ -56,6 +56,30 @@ int trusted_task_arg_nullable(void *ctx) · 55 unmodified lines | |||
| 56 | return res; | 56 | return res; |
| 57 | } | 57 | } |
| 58 | 58 | ||
| 59 | /* | ||
| 60 | * Check that the verifier does not use checkpoints created | ||
| 61 | * on path with r1 == 0 to prune path with r1 != 0. | ||
| 62 | */ | ||
| 63 | SEC("?tp_btf/task_newtask") | ||
| 64 | __failure | ||
| 65 | __flag(BPF_F_TEST_STATE_FREQ) | ||
| 66 | __msg("R1 type=scalar expected=ptr_, trusted_ptr_, rcu_ptr_") | ||
| 67 | __naked int null_btf_id_arg_global_subprog(void) | ||
| 68 | { | ||
| 69 | asm volatile ( | ||
| 70 | "call %[bpf_get_prandom_u32];" | ||
| 71 | "r1 = 42;" | ||
| 72 | "if r0 > 42 goto 1f;" | ||
| 73 | "r1 = 0;" | ||
| 74 | "1:" | ||
| 75 | "call subprog_trusted_task_nullable;" | ||
| 76 | "r0 = 0;" | ||
| 77 | "exit;" | ||
| 78 | : | ||
| 79 | : __imm(bpf_get_prandom_u32) | ||
| 80 | : __clobber_all); | ||
| 81 | } | ||
| 82 | |||
| 59 | __weak int subprog_trusted_task_nonnull(struct task_struct *task __arg_trusted) | 83 | __weak int subprog_trusted_task_nonnull(struct task_struct *task __arg_trusted) |
| 60 | { | 84 | { |
| 61 | return task->pid + task->tgid; | 85 | return task->pid + task->tgid; |